#!/bin/sh
# DF-1157 runtime trigger is NOT exercisable on this guest.
#
# wpi_rx_done (sys/dev/netif/wpi/if_wpi.c:1959-2068) runs only on the Intel
# 3945ABG (wpi) WiFi adapter's RX interrupt path. This QEMU/KVM guest has no
# WiFi hardware (pciconf shows only virtio-net 0x1af4:0x1000; no 0x028000
# network class device), so the interrupt handler is never registered and
# wpi_rx_done is never called. wpi IS compiled into the default GENERIC kernel
# (device wpi, X86_64_GENERIC:272), so the code path exists in the live image.
#
# Realistic threat model (physical Intel 3945ABG / VFIO passthrough): a buggy or
# hostile firmware/PHY (or a malicious AP) reporting head->len up to 65535 makes
# tail = (head+1)+len point past the 4KB MJUMPAGESIZE RX cluster; tail->flags is
# then dereferenced at if_wpi.c:1970 BEFORE the lower-bound check at :1984 (OOB
# heap read), and m_len is set to the unbounded len at :2028, so ieee80211_input
# walks past the cluster. Same class as iwn (DF-1123).
#
# What WAS validated here: source-trace of the unbounded head->len (VERDICT.md)
# and that fix.diff applies + compiles + boots clean (fix_validation.txt).
echo "DF-1157: runtime trigger requires an Intel 3945ABG (wpi) WiFi adapter."
echo "         Not exercisable on this QEMU/KVM guest (no WiFi hardware)."
echo "         See VERDICT.md for the source-level confirmation + fix."
exit 0